LinkStack vulnerabilities

A cross-site request forgery (CSRF) vulnerability has been discovered in LinkStackOrg LinkStack up to version 4.8.8, affecting an unknown function. The attack can be exploited remotely, and the vendor did not respond to the disclosure.

Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on the server by manipulating file path input. Successful exploitation may lead to unauthorized access to sensitive system or application files.

A vulnerability was detected in LinkStackOrg LinkStack up to 4.8.6 in the saveLink function of the file app/Http/Controllers/UserController.php (Management Endpoint component). The manipulation leads to authorization bypass. The attack can be initiated remotely and the exploit is public; the fixing pull request awaits acceptance.

A weakness has been identified in LinkStackOrg LinkStack up to 4.8.6. It affects the editPage function in app/Http/Controllers/UserController.php. Manipulation of the pageDescription argument can lead to cross site scripting, and the attack can be launched remotely.